MS-500 Risk Assessment & Management 5

Question 1

Which Microsoft Purview tool helps organizations assess compliance risk specifically against frameworks like ISO 27001, NIST 800-53, and FedRAMP?

Accepted Answer

Compliance Manager

Answer

Compliance Manager provides pre-built assessments mapped to over 300 regulatory frameworks including ISO 27001, NIST 800-53, and FedRAMP, with scored improvement actions.

Question 2

A company's risk policy requires that any user flagged as 'High' risk by Entra ID Protection be blocked from accessing cloud apps until remediated. Which control enforces this automatically?

Accepted Answer

Entra ID Conditional Access user risk policy

Answer

A Conditional Access user risk policy set to block access for High-risk users automatically enforces this requirement without manual intervention each time a risk event is detected.

Question 3

In the context of MS-500, what is 'residual risk'?

Accepted Answer

Risk that remains after security controls have been implemented

Answer

Residual risk is the remaining level of risk after all planned security controls have been applied — no control eliminates risk entirely, so residual risk must be accepted or further treated.

Question 4

Microsoft Defender for Cloud Apps allows administrators to set an app risk score threshold below which apps are automatically blocked. What governance framework concept does this implement?

Accepted Answer

Risk-based access control

Answer

Risk-based access control denies or restricts access to resources (cloud apps in this case) based on computed risk scores rather than static allow/deny lists.

Question 5

An Insider Risk Management policy alert was generated for a user exfiltrating files. The risk analyst 'confirms' the alert and escalates to an eDiscovery case. What happens to the user's risk score?

Accepted Answer

It increases as the confirmed alert adds to the user's risk history

Answer

Confirming an Insider Risk Management alert validates the risk signal, which increases the user's cumulative risk score and raises their priority for future monitoring.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Risk Assessment & Management 5